Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few services that run as a Failover Cluster. At the moment, all the members of the cluster are domain controllers, but that may not always be the case in the future.

The issue I have is that the failover instance has been registered as a domain controller for the domain. Which means that the domain for example.local controllers are:

  • dc1.example.local (Normal DC)
  • dc2.example.local (Normal DC)
  • dcdhcpfo.example.local (Failover Cluster for DHCP , which points to either DC1 or DC2)
  • dccafo.example.local (Failover Cluster for Certification Authority, which points to either DC1 or DC2)

This has become an issue, because those two extra instances do not show up in Active Directory Sites and Services (nor would I expect them to), but they are showing up as an A record for example.local.

Apart from deleting their records from the DNS zone, how can I get rid of them being listed as available domain controllers?

This has become an issue becuase we have some machines in a remote site that are using one of the failover cluster members as the DC they use for authentication, which is making things slow and weird. There is a DC in their local site which it should be using instead; but that's an issue for another day.

share|improve this question
up vote 1 down vote accepted

Per a microsoft guide at:

As a best practice, all clustered servers should have the same domain role (either member server or domain controller). The recommended role is member server.

So... I think you answered your own question... either manually fix the DNS entries (don't forget the SRV records!)... or make them all domain controllers.

If it were me, I'd be setting up dedicated DCs instead.

share|improve this answer
Yeah ok. At the moment they are all domain controllers. Interestingly there were no srv records for the failover instances, only A records. I did find some ooolllddd srv records whilst cleaning it out, so it was a good exercise anyway. When I've got time I will probably set up member servers for the roles. – Mark Henderson Apr 30 '12 at 0:50
Well ya gotta imagine the SRV records are generated for the global catalog servers to service LDAP and kerberos... but then scripting is going to call the domain's namespace to this SYSVOL and NETLOGON which is just an A record right? – SpacemanSpiff Apr 30 '12 at 0:53
I think the SRV records are also used for replication :| – SpacemanSpiff Apr 30 '12 at 0:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.